I am setting up a two tier PKI architecture. When configuring the Root CA I made a typo in the URL for for some of the repositories that went unnoticed until I finished configuration on the ICAs. I decided to uninstall ADCS on the two ICAs, reinstall it, and issue them new certificates that had the corrected values.
The problem is now that I cannot start the CS service without disable checking for CRLs because it reports my CRL server is offline.
Active Directory Certificate Services did not start: Could not load or verify the current CA certificate. SUN Behavioral Certificate Authority ICA1 The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE).
PKIview shows they are online, and can download. And the ICA certificate seems to pass all health checks. My guess is that I have some orphaned configuration settings somewhere from the old installation, but I cant find it.
certutil -verify -urlfetch C:\issuingICA1.crt
Issuer:
CN=SUN Behavioral Certificate Authority
Name Hash(sha1): 5397c531fcc0d367bbe90a6902a18b0bc19ea8bb
Name Hash(md5): 0308e448c70b204cd8deaace6a129327
Subject:
CN=SUN Behavioral Certificate Authority ICA1
DC=sun
DC=local
Name Hash(sha1): 23d1ae6e6072d585da914eae713af3aabece2c75
Name Hash(md5): ad70aaf70d6f711526bc6b64914a288e
Cert Serial Number: 1a0000000704307ca595cc5fbf000000000007
dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_BASE
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
ChainContext.dwRevocationFreshnessTime: 32 Minutes, 9 Seconds
SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
SimpleChain.dwRevocationFreshnessTime: 32 Minutes, 9 Seconds
CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=0
Issuer: CN=SUN Behavioral Certificate Authority
NotBefore: 5/31/2019 3:24 PM
NotAfter: 5/31/2029 3:34 PM
Subject: CN=SUN Behavioral Certificate Authority ICA1, DC=sun, DC=local
Serial: 1a0000000704307ca595cc5fbf000000000007
Template: SubCA
Cert: 7689421401077c5f65c43af3b3676f506bc8bc95
Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
---------------- Certificate AIA ----------------
Verified "Certificate (0)" Time: 0
[0.0] http://pki.sunbehavioral.com/pki/SUN-ROOTSUN%20Behavioral%20Certificate%20Authority.crt
---------------- Certificate CDP ----------------
Verified "Base CRL (10)" Time: 0
[0.0] http://pki.sunbehavioral.com/pki/SUN-ROOT.crl
Verified "Delta CRL (10)" Time: 0
[0.0.0] http://pki.sunbehavioral.com/pki/SUN-ROOT+.crl
---------------- Base CRL CDP ----------------
OK "Delta CRL (10)" Time: 0
[0.0] http://pki.sunbehavioral.com/pki/SUN-ROOT+.crl
---------------- Certificate OCSP ----------------
No URLs "None" Time: 0
--------------------------------
CRL 10:
Issuer: CN=SUN Behavioral Certificate Authority
ThisUpdate: 5/31/2019 4:11 PM
NextUpdate: 6/1/2039 4:31 AM
CRL: 2cdd336f50a9b053f321a566e9731b3f0cb1c02a
Delta CRL 10:
Issuer: CN=SUN Behavioral Certificate Authority
ThisUpdate: 5/31/2019 4:11 PM
NextUpdate: 6/2/2019 4:31 AM
CRL: 74c0698e31f8c24bfd70a87480498ebaff58fa22
CertContext[0][1]: dwInfoStatus=10c dwErrorStatus=0
Issuer: CN=SUN Behavioral Certificate Authority
NotBefore: 5/22/2019 9:56 AM
NotAfter: 5/22/2039 10:06 AM
Subject: CN=SUN Behavioral Certificate Authority
Serial: 1d7aa3a5ed6c17814a516849996371f3
Cert: f4d9b6c19ef2b2038f42da33bcb2844cdb113efb
Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4)
Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
---------------- Certificate AIA ----------------
No URLs "None" Time: 0
---------------- Certificate CDP ----------------
No URLs "None" Time: 0
---------------- Certificate OCSP ----------------
No URLs "None" Time: 0
--------------------------------
Issuance[0] = 1.3.6.1.4.1.53953.1
Exclude leaf cert:
Chain: 07c3f4a4cd85bbe1f65325b78ddc959b83987c71
Full chain:
Chain: 418b0685e5f45385dd7460bedcd6386253e49992
------------------------------------
Verified Issuance Policies: None
Verified Application Policies: All
Cert is a CA certificate
Leaf certificate revocation check passed
CertUtil: -verify command completed successfully.
C:\windows\system32>